docker-compose.yml

services:
    app-prod:
        image: ghcr.io/lycoon/scriptio-app:latest
        container_name: scriptio-prod
        profiles: ["prod"]
        restart: unless-stopped
        env_file: .env.prod
        build: .
        environment:
            - DATABASE_URL=postgresql://${DB_USER}:${DB_PASSWORD}@db-prod:5432/${DB_NAME}?schema=public
        depends_on:
            db-prod:
                condition: service_healthy
        networks:
            - webproxy
            - internal
        labels:
            - traefik.enable=true
            - traefik.docker.network=webproxy
            # Catch-all: the app owns everything the static landing does not claim
            # (/_next, /images, /fonts, /dictionaries, /tts, /admin, /auth,
            # /desktop-oauth, /favicon.ico, ...). Lowest priority so the landing
            # and the auth routers below win for their paths.
            - traefik.http.routers.scriptio-app.rule=Host(`scriptio.app`)
            - traefik.http.routers.scriptio-app.entrypoints=secure
            - traefik.http.routers.scriptio-app.tls=true
            - traefik.http.routers.scriptio-app.tls.certresolver=letsencrypt
            - traefik.http.routers.scriptio-app.priority=1
            # Restricted router: /projects and /api require basic auth
            - traefik.http.routers.scriptio-app-auth.rule=Host(`scriptio.app`) && (PathPrefix(`/projects`) || PathPrefix(`/api`))
            - traefik.http.routers.scriptio-app-auth.entrypoints=secure
            - traefik.http.routers.scriptio-app-auth.tls=true
            - traefik.http.routers.scriptio-app-auth.tls.certresolver=letsencrypt
            - traefik.http.routers.scriptio-app-auth.priority=100
            - traefik.http.routers.scriptio-app-auth.middlewares=prod-auth
            - traefik.http.middlewares.prod-auth.basicauth.users=${PROD_AUTH_USERS}
            # Allow CORS OPTIONS preflight to bypass basic auth
            - traefik.http.routers.scriptio-app-auth-options.rule=Host(`scriptio.app`) && (PathPrefix(`/projects`) || PathPrefix(`/api`)) && Method(`OPTIONS`)
            - traefik.http.routers.scriptio-app-auth-options.entrypoints=secure
            - traefik.http.routers.scriptio-app-auth-options.tls=true
            - traefik.http.routers.scriptio-app-auth-options.tls.certresolver=letsencrypt
            - traefik.http.routers.scriptio-app-auth-options.priority=200
            # Public contact form (from the static homepage) must reach the API
            # without basic auth. Higher priority than the auth router, no
            # middleware, so only /api/contact is exempt — the rest of /api stays gated.
            - traefik.http.routers.scriptio-app-contact.rule=Host(`scriptio.app`) && Path(`/api/contact`)
            - traefik.http.routers.scriptio-app-contact.entrypoints=secure
            - traefik.http.routers.scriptio-app-contact.tls=true
            - traefik.http.routers.scriptio-app-contact.tls.certresolver=letsencrypt
            - traefik.http.routers.scriptio-app-contact.priority=300

    # Public homepage: standalone static site (/, /privacy, /contact) served by
    # nginx. No DB, no Node, no migrations. Deployed on its own cadence by the
    # deploy-landing workflow, so app releases and failures never affect it.
    landing-prod:
        image: ghcr.io/lycoon/scriptio-landing:latest
        container_name: scriptio-landing-prod
        profiles: ["prod"]
        restart: unless-stopped
        networks:
            - webproxy
        labels:
            - traefik.enable=true
            - traefik.docker.network=webproxy
            - traefik.http.routers.scriptio-landing.rule=Host(`scriptio.app`) && (Path(`/`) || PathPrefix(`/privacy`) || PathPrefix(`/contact`) || PathPrefix(`/_site`))
            - traefik.http.routers.scriptio-landing.entrypoints=secure
            - traefik.http.routers.scriptio-landing.tls=true
            - traefik.http.routers.scriptio-landing.tls.certresolver=letsencrypt
            - traefik.http.routers.scriptio-landing.priority=100
            - traefik.http.services.scriptio-landing.loadbalancer.server.port=80

    app-staging:
        image: ghcr.io/lycoon/scriptio-app:staging
        container_name: scriptio-staging
        profiles: ["staging"]
        restart: unless-stopped
        env_file: .env.staging
        build: .
        environment:
            - DATABASE_URL=postgresql://${DB_USER}:${DB_PASSWORD}@db-staging:5432/${DB_NAME}?schema=public
        depends_on:
            db-staging:
                condition: service_healthy
        networks:
            - webproxy
            - internal
        labels:
            - traefik.enable=true
            - traefik.docker.network=webproxy
            # Catch-all (no basic auth on staging), mirrors the prod split.
            - traefik.http.routers.scriptio-staging.rule=Host(`staging.scriptio.app`)
            - traefik.http.routers.scriptio-staging.entrypoints=secure
            - traefik.http.routers.scriptio-staging.tls=true
            - traefik.http.routers.scriptio-staging.tls.certresolver=letsencrypt
            - traefik.http.routers.scriptio-staging.priority=1

    # Staging homepage: standalone static site, mirrors landing-prod.
    landing-staging:
        image: ghcr.io/lycoon/scriptio-landing:staging
        container_name: scriptio-landing-staging
        profiles: ["staging"]
        restart: unless-stopped
        networks:
            - webproxy
        labels:
            - traefik.enable=true
            - traefik.docker.network=webproxy
            - traefik.http.routers.scriptio-landing-staging.rule=Host(`staging.scriptio.app`) && (Path(`/`) || PathPrefix(`/privacy`) || PathPrefix(`/contact`) || PathPrefix(`/_site`))
            - traefik.http.routers.scriptio-landing-staging.entrypoints=secure
            - traefik.http.routers.scriptio-landing-staging.tls=true
            - traefik.http.routers.scriptio-landing-staging.tls.certresolver=letsencrypt
            - traefik.http.routers.scriptio-landing-staging.priority=100
            - traefik.http.services.scriptio-landing-staging.loadbalancer.server.port=80

    # Production Database
    db-prod:
        image: postgres:17-alpine
        profiles: ["prod"]
        restart: unless-stopped
        environment:
            POSTGRES_USER: ${DB_USER}
            POSTGRES_PASSWORD: ${DB_PASSWORD}
            POSTGRES_DB: ${DB_NAME}
        volumes:
            - ./db_prod:/var/lib/postgresql/data
        networks:
            - internal
        healthcheck:
            test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
            interval: 5s
            timeout: 5s
            retries: 5

    # Staging Database
    db-staging:
        image: postgres:17-alpine
        profiles: ["staging"]
        restart: unless-stopped
        environment:
            POSTGRES_USER: ${DB_USER}
            POSTGRES_PASSWORD: ${DB_PASSWORD}
            POSTGRES_DB: ${DB_NAME}
        volumes:
            - ./db_staging:/var/lib/postgresql/data
        networks:
            - internal
        healthcheck:
            test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
            interval: 5s
            timeout: 5s
            retries: 5

    # Testing Database
    db-dev:
        image: postgres:17-alpine
        profiles: ["dev"]
        restart: unless-stopped
        ports:
            - "5433:5432"
        environment:
            POSTGRES_USER: ${DB_USER}
            POSTGRES_PASSWORD: ${DB_PASSWORD}
            POSTGRES_DB: ${DB_NAME}
        volumes:
            - ./db_dev:/var/lib/postgresql/data
        healthcheck:
            test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
            interval: 5s
            timeout: 5s
            retries: 5

    prometheus:
        image: prom/prometheus:latest
        container_name: scriptio-prometheus
        profiles: ["prod"]
        restart: unless-stopped
        command:
            - --config.file=/etc/prometheus/prometheus.yml
            - --storage.tsdb.retention.time=30d
        volumes:
            - ./monitoring/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
            - prometheus_data:/prometheus
        configs:
            - source: metrics_bearer_token
              target: /etc/prometheus/bearer-token
              mode: 0400
        networks:
            - internal
        depends_on:
            - app-prod

    grafana:
        image: grafana/grafana:latest
        container_name: scriptio-grafana
        profiles: ["prod"]
        restart: unless-stopped
        environment:
            - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
            - GF_SERVER_ROOT_URL=https://monitoring.scriptio.app
            - GF_USERS_ALLOW_SIGN_UP=false
            - GF_SMTP_ENABLED=true
            - GF_SMTP_HOST=${SMTP_HOST}:587
            - GF_SMTP_USER=${SMTP_USER}
            - GF_SMTP_PASSWORD=${SMTP_SECRET}
            - GF_SMTP_FROM_ADDRESS=noreply@scriptio.app
            - GF_SMTP_FROM_NAME=Scriptio Monitoring
            - APP_MEMORY_LIMIT_BYTES=${APP_MEMORY_LIMIT_BYTES}
            - DB_SIZE_LIMIT_BYTES=${DB_SIZE_LIMIT_BYTES}
        volumes:
            - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
            - ./monitoring/grafana/dashboards:/etc/grafana/dashboards:ro
            - grafana_data:/var/lib/grafana
        networks:
            - webproxy
            - internal
        depends_on:
            - prometheus
        labels:
            - traefik.enable=true
            - traefik.docker.network=webproxy
            - traefik.http.routers.scriptio-monitoring.rule=Host(`monitoring.scriptio.app`)
            - traefik.http.routers.scriptio-monitoring.entrypoints=secure
            - traefik.http.routers.scriptio-monitoring.tls=true
            - traefik.http.routers.scriptio-monitoring.tls.certresolver=letsencrypt
            - traefik.http.routers.scriptio-monitoring.middlewares=monitoring-auth
            - traefik.http.middlewares.monitoring-auth.basicauth.users=${MONITORING_AUTH_USERS}
            - traefik.http.services.scriptio-monitoring.loadbalancer.server.port=3000

configs:
    metrics_bearer_token:
        content: ${METRICS_BEARER_TOKEN}

volumes:
    prometheus_data:
    grafana_data:

networks:
    webproxy:
        external: true
    internal:
        external: false